Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    65s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06/11/2022, 09:29

General

  • Target

    23df6fc97c74479873bc752b28f44193234a9df58570abfcbcfe70881adcbbb5.exe

  • Size

    54KB

  • MD5

    0a1241aa0be6fa065acc2b96c29d99e2

  • SHA1

    e9986b1ba8706f0b273b441fa55669759756cc1f

  • SHA256

    23df6fc97c74479873bc752b28f44193234a9df58570abfcbcfe70881adcbbb5

  • SHA512

    e7c9e5f480738c9107cb0d5f2f042eb2b14dcad91194477d834fe14d6eaa989ba95c0e5167663a3c86d8a53bbf75c9a94d4d82ef464acaa1cb8cb332f255160d

  • SSDEEP

    768:QevYqsI6ph5gl69z8bmi6m8+/U0te9nzjAJMcGhDWIO2GmZLfHIOOM59:81Gl69z8t6m8Dzc2WIVL

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1256
      • C:\Users\Admin\AppData\Local\Temp\23df6fc97c74479873bc752b28f44193234a9df58570abfcbcfe70881adcbbb5.exe
        "C:\Users\Admin\AppData\Local\Temp\23df6fc97c74479873bc752b28f44193234a9df58570abfcbcfe70881adcbbb5.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1828
        • C:\Users\Admin\AppData\Local\Temp\23df6fc97c74479873bc752b28f44193234a9df58570abfcbcfe70881adcbbb5.exe
          "C:\Users\Admin\AppData\Local\Temp\23df6fc97c74479873bc752b28f44193234a9df58570abfcbcfe70881adcbbb5.exe"
          3⤵
          • Drops startup file
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1752

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1256-63-0x00000000029A0000-0x00000000029A3000-memory.dmp

      Filesize

      12KB

    • memory/1752-58-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB

    • memory/1752-62-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB

    • memory/1752-65-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB

    • memory/1828-54-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/1828-56-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/1828-55-0x0000000000401000-0x0000000000405000-memory.dmp

      Filesize

      16KB

    • memory/1828-57-0x0000000075F51000-0x0000000075F53000-memory.dmp

      Filesize

      8KB

    • memory/1828-61-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB